5451d9f15eda6bae4925c7c6824828bd38eab8a92d8025b77301151d0645fe47

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 1.1MB
Sample260820-hf3ssafp91
SHA256 5451d9f15eda6bae4925c7c6824828bd38eab8a92d8025b77301151d0645fe47
MD5 f345e70266d5b2596adefe063a77dccc
SHA1 ae720ba9fc89e802282cf0276e9099a51ffce52a
SHA512 2232b4a6e8d1d80c182624b6fe1f2fb7a189bdf2e7056366de674b5c5a3d10297d123380c1d4c6ec26de15c0a279546b5c22935a8eab084f1b4cc3a3005f84d7
SSDEEP 12288:ndoLqz1277CjAI8Uax0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQU:do7w8UXgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T123459E93FD49C461D1EA15F0C8E7D7E2473B7D600D34809B725A332EE9386DC9A19EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1012	elevation_service.exe
3524	elevation_service.exe
2512	maintenanceservice.exe
4720	OSE.EXE
4500	PerceptionSimulationService.exe
6048	perfhost.exe
3612	ReFsDedupSvc.exe
5880	SensorDataService.exe
4432	ssh-agent.exe
1076	AgentService.exe
3604	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bc749a3d23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc7859406f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000179b68406f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004b1a4e016f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a7a90016f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed3cbc026f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e967a3006f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d67747016f30dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ba7d3016f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
1012	elevation_service.exe
1012	elevation_service.exe
1012	elevation_service.exe
1012	elevation_service.exe
1012	elevation_service.exe
1012	elevation_service.exe
1012	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeBackupPrivilege	3612	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3612	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3612	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3612	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3612	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3612	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3612	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3612	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3612	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3612	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1076	AgentService.exe
Token: 33	3604	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3604	SearchIndexer.exe
Token: SeDebugPrivilege	4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4852	2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	1012	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 2536	3604	SearchIndexer.exe	100
PID 3604 wrote to memory of 772	3604	SearchIndexer.exe	101
PID 3604 wrote to memory of 1344	3604	SearchIndexer.exe	102
PID 3604 wrote to memory of 4332	3604	SearchIndexer.exe	103
PID 3604 wrote to memory of 2956	3604	SearchIndexer.exe	111
PID 3604 wrote to memory of 2008	3604	SearchIndexer.exe	112
PID 3604 wrote to memory of 4632	3604	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f345e70266d5b2596adefe063a77dccc_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3524

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2512

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5880

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2536
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e09a8d67c7c078e56a958511e8487698aaa922a92d92f630338c558f022e3313
MD5 1da1cb0e7de19072b158547ae5ddc738
SHA1 58914c8c996daa6498be62aae8cf2b3c3ee8c19a
SHA512 79c0cab9cf5eea6a9ce31d1ea73132fb2e05a295a7f7df7e569c974e4eb8f97499d2c844e1e315ad7d2b2c57a77c337849f3f908cda1ebfa408d5573a869e28e
SSDEEP 49152:nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnqe30jaNf1TWbdz:V3q6sjBPU023W
TLSH
T151D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 17022d2957c663aa7b45964637c6402b930c8c51992ca2d9ca1b7cf014980268
MD5 7a0e8d9b1af6d9c469a5d7f8ab42d256
SHA1 8b30d293ef4adfe8ce550737435aeaae52b1d14e
SHA512 44c11d79f8f0cea71b66b0ecf404b774c6e759c1044cbeeacd87e15803fa85646ad4b27378a37016c08a9edaa4eb7bde020395d7226bab6f510781f2c60f4eb5
SSDEEP 24576:/XYfDtczAEgXe4i7ojhsP5Lgrk1TWb4AN5:Ktc4e30jaNf1TWbdz
TLSH
T18465F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e11f829739010782b73803180e64d3c53f0e863a83a13aa02642bfa8e44b17f7
MD5 e8e1a031b60f70f925f1c8872d14977b
SHA1 dd85d3a41b6eb3163ca4fd6ada082179ad3e75e6
SHA512 9fadf03b98ce38e4c538f7cf3b2e1c3003813b9afa2dd1e30309ae11a1c694e425626762b4318e979dc64a077b2753dfb6e7100972d97c6e822d11b4c5d9dd5f
SSDEEP 24576:m0Le5ji0hmxxrMrgXe4i7ojhsP5Lgrk1TWb4AN5:mPji0Ajde30jaNf1TWbdz
TLSH
T14985AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2fa0e60afb48453c70b4ce8dd7535a5fec957ccb69f9c134b10d4b319c684f67
MD5 d0f1f7f7bb480fdf6483c5222322ba4b
SHA1 38bd5a89e9adad305d7ff3644ed3a4c2f48cb8ab
SHA512 f585eb351c767eae182c0b09d9e457549d086fdfe14bfc913fd1ee34548d030c93292ed78488ec6b7f66d6136d027e116f0175e7c448a1dfb60241f76e2da10f
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWn6q8wyutgXe4i7ojhsP5Lgrk1TWb4AN5://ezSC6vUzPveHjy5e30jaNf1TWbdz
TLSH
T134756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 579603fc8f56ed62b41777c15738c3a5b97e33b4ae6e42f121d6199f6c5a7199
MD5 a122744f21adfb1b465ef5729431ca48
SHA1 2a555cb8af3bb34c6b1fd37650b8aa5478c19aba
SHA512 b13673b4abe1f1ffadbe4e1eddb85ad511f9d16f47cd496e34672aea357c77210c6f68371179df4552d4e1053fe99556374b37f648b127cf1b377971e7325cb3
SSDEEP 24576:oVbqPb88hv/l+YIgXe4i7ojhsP5Lgrk1TWb4AN5:oVO88hXl+Ae30jaNf1TWbdz
TLSH
T16E559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c3ccf9fb919de90b1d12d0187915d4319d704916e09e24c49fc71c9b2e45cb06
MD5 ac23f4841d24baab19b2f1fa84aea0c0
SHA1 d257d746a87927d18eb4fde9951f79b52b5b2296
SHA512 66cc72dfef7700f512ec6e17278d7840d6787e24a74fede280eaac1b7a4a81bd2df8bb9583a0dba2bf619b3fb8aed5565227dd391a55176a682b0735505a58a8
SSDEEP 12288:ZL20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZLvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1794523919F5409C6E38FC3F4A0F7CBD1E9A11EC061444E6B47E0BE931DBC899EAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1110a1b47e25832ec2c224b002d7b467c9d4bf81e02bd979176a0a5a8b4e6317
MD5 f7e8a8e937eb1e955782d21749bc6c15
SHA1 ab48550874e3ebb2c547bc2020891a16e52a5061
SHA512 85c48a8b91233b25ae5c474c9d68c2693685d4382b09753eabe8627c2010de3a32a5e836a4030b147b8463f0c3cc2fd0e9d266f7b82d3ca1534feee8285224ec
SSDEEP 12288:0eBNUbTVO86Uj0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0JIUAgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19765CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 03bfd9e16e6d1c39a50d65983932441e853057ac78027c6fd768e914daade549
MD5 8f8991f0a26e621abc74d136aedc18e9
SHA1 6989b6371190a12a994e69a2439b8950e25a30ec
SHA512 3288cffc35147d26a8759b1538e452ac9fb2d84215425db26de16162217f7b55d50e38880b46b196d73fddc5a763cf9b8a15b701443c2e339298f555b5c62fc8
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THJ:0QvGAdlCEL8c/DRNw5CYU023W
TLSH
T114267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9168ae174fae516cb8feaa13be74d84d05c7e60e977fc0914b6ace93345ac4b8
MD5 727c473a40ff1dd549a80ee9b50d3d59
SHA1 0322e4fb826409300fb6f4330361ab411c598377
SHA512 03f46b501ac8e525c3bc67734fb61dfc0bd52b23de45f7b744fb2324ea7d2d6eb0387aa7d0389be32a45e58383b0ea65f6ce0e379e9c94d4c7e625795a5fa41e
SSDEEP 24576:C0ewsAjqgXe4i7ojhsP5Lgrk1TWb4AN5:TljNe30jaNf1TWbdz
TLSH
T1CF75E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d1a23195bb3d9531e8d1ba9fcff8921926f384edbedc1f6c8adac731de3b185a
MD5 2f66ff665f0da5b75c4630dc1b634f94
SHA1 f0649c0c152f7d823e7d4f19b0776d79ba26332a
SHA512 2e6dd2b16cc1bc3a5382847472a01de19bb393ca7a63876f1eeb8b3b0969a27a6c12d5d832a5787f9b3bd8c54dea37ed0917a77fa4a890d773058557b125ffa7
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHlp4W:DUEtQevvqc2W1cpV2tI3234W
TLSH
T161474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b021ac31d1c4f975b60747c72a2ccad9bc22623744e2928719bb3d42b8b748db
MD5 8a71c4a515975adac86494c23eae8cf7
SHA1 abd004e4647fc2ec5c57ab8203e3929c1495d488
SHA512 c3f3d3464d1361bed3a048cbff06a6e4df7eb580015f2baf1bc2ba03bb455ea0a66dbdaca5578c0cb931773f6bba71550076fbaa5a3abedc738d7d07e01afd72
SSDEEP 49152:SCbRquA/m2yL5zTfFiV+XenmE3/zte30jaNf1TWbdz:3oquVjnmUU023W
TLSH
T1D2D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d1b522b3f920f2a7c941e7b673bf85c0154c9a779008f600a0fa71f45db37802
MD5 4261ff9041aafc101cd3413cbde3e372
SHA1 aaf57b4d85f426cfd2da50090532b94886467f8d
SHA512 d77dd7488cd5d3f40976767f5758666ba4ff24b01b6a3b2692dca1fbb6e6d8814c5cdc9afd4cdba76a377453f2b282e6ea609520de82eef337fb6b3f9d5aacf6
SSDEEP 24576:XAhGL3IFoiwtA5l7S53JgXe4i7ojhsP5Lgrk1TWb4AN5:XAMUFoiq5Ee30jaNf1TWbdz
TLSH
T12A359E81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 21fbf243d842e68fa00b24572f0e17bb8c2a739dd8ab1b7dce53c36c0efd9559
MD5 1bdeb013d10d7ee86835356eb16b445b
SHA1 8024f4a4c3de09cf012797ea848e562080801d2e
SHA512 30da4213a1485eab5a65d019cc9a838eeeab87c4f4e2f956819d12ddeac9e7a390087db33a2c29430c64a66075b3c804efe2631f2811d7e50881a0514fdae532
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+Cs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TT:vwu4OW2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18F65E14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 eccd02638e457676643c4b41f999ca47c1dd2682ba87f0277321f3dc3aebc30a
MD5 3555576cb6b52f14d533445e3aea45a1
SHA1 d1e7b4f2fdd462574e43bfeba625388bfdecf5b5
SHA512 3c1b70ea0ea5de829a53f60e5fdf23d71611dd94d4bdbb0234a2d1b9f5983bada4a41a06db6dd8c932fa856662023843810feee7ff92dceefe8e3396466e59c8
SSDEEP 12288:eeZ1Iyt0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DZujgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10B55129637E421F9E2978278D4F28741E7B23882233147CF06A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7d94fbf14fff2bc628e789da1225491306a4d8ad509a0d71e1727a13b34266cc
MD5 cd9b43bcb977aa4a6fb1095c68dedf96
SHA1 ee28672eca882757d9fbfb2b3ea4d80c7ff9a680
SHA512 bef350839d7fad2cb7af9bd6adfc9c92ff6d4a78f92d3b5de5363ff14fa672108ecc0b78c656a6b62dd1df00f29270b49b197cacd538e406fbaef6688f753239
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UN:NQRQyi36YOcPbLvw2gAf+PN3TU023W
TLSH
T18C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 958285a8ee4395b073e16922658b1d12cfe582af4db7655bda38a371a2ba675c
MD5 dafa9d3f0404dfceb264c10fe042383b
SHA1 ea7a7356c27718b1bad0d80458e7e9694d5f0aa2
SHA512 b33d294eabd8ca2880bc64c5a0b8141869630ba1f260a3dc4285612ecda58a0d91078330ab10cc46f171be9d90c4277d002b0059427d6fcc3600c4a963056236
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UN:HQRQyi36YOcPbLvw2gAf+PN3TU023W
TLSH
T170667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 240c3fb2088145f7e35b4d386f3c9741eb56457b14c2afc80b3a80d33f5783c4
MD5 54118cd7342b334da9004da46b7cb543
SHA1 754fb06c4ded9238791df0f0fe07a136cb30354f
SHA512 5f84f45563d20e0e3c55e39aa3939b51b779d90eeeb3513d03f21fbc3f41c8e02ee36a85152cded02c1c22779d14b204fdbe18776c639d5c4041ee2b23af1c23
SSDEEP 49152:W68Qg55nhceWu7PNU3/de30jaNf1TWbdz:0thLRc/dU023W
TLSH
T16DB55933B2F60099C04DE1769F4A872196E27C718FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 083c80691acb88359a9b50e5dee0c67e82a65e8912f16f280a0550668128c6d4
MD5 5bb3f6ac85523b55b71bef487cd83a96
SHA1 3d7460f60b0a90e9fe40049a7fca49b9e1d8d8ce
SHA512 2bc0eeeab6cfe1a01a6cb994f8cec50977e9016f740836670640cc1c3477c992bc28d19f19dd5b73713e701077f885905f4a2f3b18e07035d6d3ce4f319abc10
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99f:4y5112gYy5azzVvt69nLKnhZmU023W
TLSH
T1FE168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0597f0221bc5329cde7c814e5d4cf2a9ebb2679b1e222ea3117cae4963b873cd
MD5 69074f0b90e38704755547a719cb8685
SHA1 09b9968c7099eddc7ff85857feaebac2db6b20d0
SHA512 f8d6cd1235a030d9f1e11a94f6ca54e92fd3c8b95e3aa93dbbd9ab7d39057f5921ea6c0ce766ddd4e32361f49536d326a29b2d1d230bcab96c377df8243ba2b6
SSDEEP 49152:iB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl7e30jaNf1TWbdz:Qu6Jmdxd2d7U023W
TLSH
T1A3D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb2525aab409a7be5c23a94f198c45c1d04490d11e0f9632a1b894c58b10b1a5
MD5 de27b49d6cca84805da2a106e27b81eb
SHA1 f57ebd7cbac7d7d6ad475a7556fcc9fc7972108c
SHA512 856d9c8bb09446dc6f5930f4a0cea32827b3141eb3bc0795bc7c96ca96b782b85bae48f927d17a9ec040067a61ab6970bba81c157838a2371065b8aebbc706f7
SSDEEP 49152:X1hpsNoJpF1A63U44CwH7R4xne30jaNf1TWbdz:XmifPWRUU023W
TLSH
T148B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b3326d16154cfc666acd43928e091f7353ec456cda7e57a6a0170bef6036c38f
MD5 a53318a8ad95cab8fe1ff076d064fdc6
SHA1 ec10007ad09e0698c6fd63776c4857d5314bcfd1
SHA512 9a821dff5fc698eab3983ca94b5c6e551af48bf387f46a489fef3266fe92783a511d98914f8571d2304479781a3091d6b76955dd660f50c51d46ba711c7d4c3d
SSDEEP 49152:uSuZQIY0Be2KcRVtOnks6NMHqae30jaNf1TWbdz:g5dKii61aU023W
TLSH
T130C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8da77fb3dce482b32949a05e1dd9a2b1331530e29b7a405c438efe4edaabf675
MD5 3398d76c425ba4d012f8f503fd41b4ed
SHA1 59688dbc6ac66b93fd7c6fc616cecf63e54308eb
SHA512 1579b314023921d809dd939e5fc74fcecbe8b96761e1194e944d89c84aef35f727d665da6ed5f8c99ce1bac863e1097c41ca682751af09658b026b03a57e5e08
SSDEEP 49152:KhtSn8EApI0fig3giDn0AP5wre30jaNf1TWbdz:rX2imphwU023W
TLSH
T1C995BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d36f16c0acf22d32c0f4905483c97ec70d019824a4e8a8f501822dd95f592ce3
MD5 396e0436ddd31d40c4a809e4ed6c79cc
SHA1 e12e6b99e02b1ff7e7529175a05ffc3583bd15ab
SHA512 0a1118b44f1f0d13bd827de0fc6fbf2f6f1d5813eba4960fb341cc6929f841bf7ecd17bc21673a98ed8ec2f2f60ce6ee97e2e8e6887c336596a5587d9818d6d5
SSDEEP 12288:Bu0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BHgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T183452391AE550ACAE34BC3F0D0F787C1E9A11EC272444D6B17E1B6631DBCCDA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 80a67ab2a5037b3680a2aeb76a8362c0902176b8ffb8551899a28bbf7bc14460
MD5 af04c091c48d499caae3e304c204fb25
SHA1 bb12a03ab23b23f424c816cfb61e9372c51411e0
SHA512 bea05ba62de3e8fc56ff0625faea585507d1087c9ee54c973db9683190524826203b63044ab1e16638ae16e23d765359be73b5dda97ac581835251aa63651b11
SSDEEP 12288:iR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:iegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1814523A1AE550ACAE34BC3F0D0F7C7D1E9A01FC272444D6B57E0F9531DBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 344dffb82c26e813a95dba56b51c907ba8d8ea17ceb78f83a2ef1af063a32a9c
MD5 0792b426db69c1d2383eee441c46d281
SHA1 bb1b73e2201cb01bd29efdb8cb0585c9d257814e
SHA512 e2beed906487d8c6d23f38fad8cf8406e47e26e71529f85088ee263ca2da4f225eb42ccc15ace6474762ab2e89e9766519c292a1919724592f18c76b5b826480
SSDEEP 12288:h70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:h4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E04523A1AE5509CAE34BC3F0D0F787D1E9A01EC272404D6B57E1F9531DBCCDA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 756c9f5ab03a3865cc45272df0f450328045e0246f8bfb570bfa98c25fc13c92
MD5 faa016b2b37909540ea49f0a1e60b55c
SHA1 8ccad54f29e03cb18dcf88d25b0ec2213d533709
SHA512 cc91991ef930c749d2d1e586a7fe3a81b3d805f80704e12f4e6fb7c45c636bc314a7119102895f1a1a4774e17597b95201ea6b0c1df13cd5cd8affdfb53715fe
SSDEEP 12288:BVI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1814523526F6905C6E28BC3F4C0F38791E6F13DC173114BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f1bcede1066d0636ac99c8f54921f4c94f94fa4ffeaa8404503816d42c3c5ba8
MD5 06b2f867b9a926d8f1ec4a6e3346d1d1
SHA1 bf4c9bf3f6462bfa6469234818a534059919546b
SHA512 dd4fa9e08d3f8518773a32984f4f1aa160f9d355451ab4239bb4e53bc66f8e714eef12228b1310cfff3a388611d9979fa2a2e5de5e05543292dd6b820ed1318a
SSDEEP 12288:sQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:sxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T154452391AE5509CAE34FC3F0D0F787D1E9A01EC272404D6B57E0F9631DBC89A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 01d72ee553b5ce9fe2cce1ec82ffc392ed76966507dd5f020ab0251db8c95594
MD5 a172d0763f354c5e2cddb9c62b0cdb3f
SHA1 7baebe574ed5a0814f530b8594ba106c79b14557
SHA512 3e1d10b3cf70d30686c0da7087f995302605d362ccba25994747ce0e663e331d0a12c4618f2661731f975a8d98c87367885fb86e1a39c9f45e72ff535c26e188
SSDEEP 12288:x10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16D452391AE5509CAE34BC3F0D0F787D1E9A01FC272444D6B17E0F9535DBC89A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a06a179fe29d9f8d181fd9d95bb41dc3003f4f17c29808560db30b332cb1755b
MD5 232ff2a4da00e1bc72d3d7dd5cbac34a
SHA1 a4965aec7b5f829817745718b6138a4ca059f620
SHA512 61cd634993da06d72ff4f3cb1249443e6a5c7320a6a6a5f314f1fce4f8bc7e48278f9d1efbfe016aa1e6167ab43fe02a80a92e60618506f0a71559cf148c3cad
SSDEEP 12288:f50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fmgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1304523A1AE550ACAE34FC3F0D0F7C7D1E9A01FC272444D6B57E0F9531DBC8A96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e4e90d3d9e277cdd50f8a8afab3136d2498a258b52418ef26ae0b932fd2d5b56
MD5 f56f3b6c9e697aecdedb94b8b780726d
SHA1 cd81e05025084216f72d94a1fe7bffbc5664748a
SHA512 692b3c6ee22ed937be655e7bc386ba203f95555e629ff6a68386a3314c11c8a358ff777c57e59ae43b2ce7d2851f534079aa2aee3aa0d87a0e31ab16f34cbe9e
SSDEEP 24576:rZMRzFVSO+gXe4i7ojhsP5Lgrk1TWb4AN5:rZMRzfFe30jaNf1TWbdz
TLSH
T1E7650195B3900CF8ED67827EC8A68A02D6B27C551760CA1F03F436671F773A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5792b61eeb672dfc0876d41915520ffc541b2984b94387abea92413e189e6ba8
MD5 6318f2db6af69560157efc7881af9932
SHA1 325e0a7425bf809eb0369b2f2486f52422eec157
SHA512 b3616d58b5065f730d480c2d5aaff101705f4bd0a80170b489125d1af6c7634f192771edbf0c460a6c92d62acc1d193184fdc3192a0b34ff47e9f3635dd7ad0b
SSDEEP 12288:pa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F4452392AE5509CAE34BC3F0D0F787D1E9E01FC272404D6B57E1F9631DBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1d8e9602fb20d89b0f79663457380a977c016c732e87945c504eaa016579d995
MD5 f726e1ca530687fb8add1af4614c294f
SHA1 fd23bbfd7e4a659c4a60ed399343af25f04d8c02
SHA512 dd0f39a97c12c8bd078cc944540ee044c7f4e64cadbe566caa51bee26e6b8a0a5e41d0c132478192593b64a1c834e7d36f978720ce9151a184313871aa334e6b
SSDEEP 12288:5m0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BC452392AE5509C6E34BC3F0D0F787D1E9A01FC672404D6B57E1FA531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 20d9fda3c8b7cefc3e0bf3ac27b4c006b2a335f0e7a7b0979653197b4a1cd221
MD5 ff6d22657892122f2d92fd6ee3d3a7d6
SHA1 312abc016faa5680e96ea008d8c81f7c4a76325a
SHA512 f1b6a41f7b8809a469a3258c076e90ac934c0c6d37e6febbd14bb1bc2030c770ffa8b0927f443d091583b2ee145ceffe98a354eb375bbdbf9bfc8f862dff2e37
SSDEEP 12288:VyPz5L8t0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8zy6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13D55025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ee8caeb8faf6efbed615936400ac31c3afae4f1988402dc3ce6ca6457f9bfda1
MD5 ca32a6be94f9cf219f60786c2ca4baa3
SHA1 d3c5b87329128dfe2f72e42d1a8b383ba1a88107
SHA512 e0456cccbdf683c985918e3a12c3250cb2ce68e7b5213ba0a4fd6504c101bc6d0ef252cc2c4a86766c8d100b330b95d9505738f5f57bcb62448c707b0b0916eb
SSDEEP 12288:Xa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T181452392AE5509CAE34BC3F0D0F787D1E9A01FC272404D6B57E1F9631DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d8da0fbc7ed6c12b2e980231ee092cd0c5846c9903f30c81af54212270b1c6d4
MD5 72c42bd7b943d674ba97032d0bbf6f62
SHA1 25af7cdada8dc575f3ec9a7ef39979d9ee5d804c
SHA512 3f32c6aa35621e445da9fed6221a300974a7b46297fec74a2e71b87d843a5628f55d17034ff80d08dda9479426611e43d5529b77f745eaa329f1bb4aeaba4285
SSDEEP 12288:pa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15D452391AE5509CAE34BC3F0D0F787D1E9A01FC272404D6B57E1F9631DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6cd5f5b126441ea012fb08f9a50dff099f9a7ab4e5abd6269bfe8114b4e0f6c2
MD5 72bb2b16df0335959801e5a2149fa790
SHA1 d50542b86e7a3d274e0a974aa1f36e749dd6bb56
SHA512 df85a9ff7b0f0d75ab438a65b6ba96260b761ed02fab2ce23c0218e6bb461784787ac0d27984df9cc1d0c611f43488f387f6fc4bc24c849ee45047db91b61067
SSDEEP 12288:qyPz5L8t0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3zy6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19355025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8342273151ad79959fa9b589c1767507f3056f9d7b1592a12a18598ec6d7c06d
MD5 9e8fe6e683b43bbd434908e14fc6a627
SHA1 8b5e6b6134f116ee1f25c491d5fbeae28f224cfd
SHA512 3bfd0f1e7f608981f31c1328f080cce94658be7499617017ed428b552d3050847a4978672260a8a459342b08f6addea8650ca89849ac0d0aaaf00ae97e51dfa2
SSDEEP 24576:HTDaLl3z0zDogXe4i7ojhsP5Lgrk1TWb4AN5:HTuLljoe30jaNf1TWbdz
TLSH
T17B6502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 bf5d40691bd3166d84a0a9cb5678df67d2822451bb8d6ed9216071545a623eed
MD5 446090bb17842565d466b8f97cd9e9d0
SHA1 9c33d5b6d8cabd6fd7a028216a06023b14774e49
SHA512 298be1d1cdd482765e01f5ef25ebd0d637971db5d0a7d0f554b3ff53b1f6b48cdfbdee522b2ef930df5140856904e1a2d18261feca0b17d364364f6cffc394a8
SSDEEP 24576:r3vd9CHKy7GZcgXe4i7ojhsP5Lgrk1TWb4AN5:Lvd9CHKyaFe30jaNf1TWbdz
TLSH
T18675CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4d36863d9cfd1b235d589185cb7dad52a39a42568e25dd56d193c92a1e3d3d8e
MD5 49ed660d71809b4a064f67fae938a753
SHA1 2f6b86542a800e050449c45674eda3a0fe2f7f32
SHA512 229e3c04e28db7dfd423f765334ac136968a141bed15ffdee48c188e46e042394e1a353f174f5136c579437635e83f6d6e477d588923df9f11eeba86dfc3e950
SSDEEP 12288:4b0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4YgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T186452391AE5509CAE34BC3F0D0F787D1E9E01EC272404D6B57E1B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7aec6ac8aca8163e00406cc38d89c1dee86232934c8bf317f4573ce67a935a4a
MD5 15c244a55c839c2597a998d0ff480157
SHA1 d1aed6be9e99f25b85889783aae8598720fa2f3e
SHA512 d67a16673f8e7322a5fa2b31b90ab1329c8fbebe636ddf6020ad0fef9883562ad8b01df71e31eea92f5412f4785af574bcad364548aabdb3fc2fbaa4b0943fa7
SSDEEP 12288:iN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:iagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1504523A1AE5509CAE34FC3F0D0F7C7D1E9A01FC172404E6B57E1B9631DBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e9c4e23d6daabfa8e09d79a8a875edc8e4c513a48c7773f5415d90143253fe64
MD5 d3423710eca54ffb23cc8e2170b58fbd
SHA1 dde065f243c6169f8665b2fe59c95e7d4fd1ad74
SHA512 fe8856d33b08188661dc9742fcf210776523cc0682e206b605240f29dfc974759e91218b54b14f4449634388f6512f6047fab1bd4d6620708559a0ff664350f7
SSDEEP 12288:wU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:w1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1264523A1AE5509CAE34FC3F0D0E787D1E9E01FC272404D6B57E1FA531DBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ee865393c40321d411210065c22b54df10901c0e56b4d16c7877ae1da27bbdc8
MD5 1853bc279e3896c4f2b4a30af18c4532
SHA1 14d8b702fd8a5fbc93407c742caf8d31c4cced11
SHA512 90339f9a5fc7a035b467482dde6acadfc42edd384eb1ab13678445713ab2b603509d4662a75e15d14dd8be2f9edcc80a710f79e5aa15bace549f037f286f3833
SSDEEP 12288:wa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1704523A1AE5509CAE34BC3F0D0F787D1E9E01FC272404E6B57E1F9531DBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 85a392df46a9219150ca44c1b7dd2bc9556a394f78f3f15f3893f99ab9e2cc74
MD5 49e7727a4d2a036f8dca2c85614752f4
SHA1 3335c994ee4530b3f54e548604e1e1671a1f29f0
SHA512 b86a2aece589408208367027c60298da6ddd3cb69fd2c70574aeee5901d17b3246257bdc28d733cc5f21872b88abc48de850d07b25aa07ffb9b5551fd6868453
SSDEEP 12288:ab0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A6452391AE5509CAE34BC3F0D0F787D1E9E01EC272404D6B57E1F9631DBC89A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e963fdd355246e33a9f8ec55a3d17afce6c6e7648c80186ce44dfbe39b7b874f
MD5 b32906b56bab5aab155ac31c77096cdc
SHA1 b09fbdbec3433ac66b7a06df531d753ac85bd455
SHA512 f0bce7902f9195e7482be091928b89b2ef63c47c0afd25b67457cebd48ac4383a0fca0f845dfbe25ba16ba708ef8c9dea129939d49acd1fb75a39d4ddac6bdd5
SSDEEP 12288:FC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T145452391AE5509CAE34BC3F0D0F787D1E9E01FC172414E6B57E1FA531EBC89A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2f7d07dc46ae68357aa7cf6b0f040af0101b0344eae83ca69f46285c143ff376
MD5 68cd0997061509e558edd8b19e142f3a
SHA1 af29a538d0d36b1a69488aa78bf2e61c373db286
SHA512 1a22f4861f60305931104d7c43dba4286c7da9ceb475d558451b60e42effd8c021518127b44dec975674b7eb1eb7d6474b11de454b3c9de0df697a98372f9ef0
SSDEEP 12288:kQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T180452391AE5509CAE34BC3F0D0F787D1E9A01EC272404D6B57E1F9631DBCCDA6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 941d897afa627c6ef769ad6bb6e7137e4e0ac33ea7ff40d288c2d31a072a7505
MD5 2588482c347e4bb77f923fc41d84a59a
SHA1 15849aa831e3c00c8771344d6c85e895d5ad0dc8
SHA512 25804c046055fe5283dd731413468cefe0728994d71135a144f968a766d73443f5b3048dbf6c35569fb148f37e1acb3e1b64acc34c5cd0778cc112b29c1c63c2
SSDEEP 24576:wfwvUk9RX6wkyAIPgXe4i7ojhsP5Lgrk1TWb4AN5:EMnYIGe30jaNf1TWbdz
TLSH
T18C85DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e213407c2ff47e63cc2a034f766d23f8ac0d9c6e013409a6c1fce37212463392
MD5 d491b56bf5a07ba0556116e9b4cd1204
SHA1 311b8deb88ac8b1d3b2558612a21838d98864bc3
SHA512 40fc7b531908688474a6cf488d1628183d59ff2bef145af042e7ce8c586f779af3f297d6d28991de18d37d2220fe8d1bde4ff01f34644933434974a398d01013
SSDEEP 49152:iYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Le30jaNf1TWbp:5ySzPzU023W
TLSH
T112067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 793d773798b0db85eec043ecf4753e8bbc3431a9b8e52f064a215981e9b8c713
MD5 38ed9632e79db05459c56d5057881f5e
SHA1 f24d108d88ac053ff10fa15bc3aa2d2fc1f9f5ba
SHA512 6e2c9379d7bb7d683d977726c74fdc7f08d4305de1b6b056452935e0f8408331ba1ba0782172723ddc55e4f8c6c5419b5da138ddf6f0f0778ac5d361bce16c61
SSDEEP 24576:147Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYOgXe4i7ojhsP5Lgrk1TWb4AN5:147JUQjTirIhCnDHUPfF/7e30jaNf1Te
TLSH
T17A65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 53eca8f71a7d52e963b7e0a7f151cea0a3fd5a5a4a54faf07c65e3a344c278f0
MD5 60205cf58816e08f84e59161b5a73060
SHA1 76aa7ea86308212d672a67f67ff0790be899bfe6
SHA512 8297ab9aa16143cfc30dca61176baf67b5b1fc174b961ff9ff708fdcf9470392400ca30de7b822a8e47d480f8fc88f0a4c40816138a031ff3d3233f09626fcd4
SSDEEP 12288:rbsfq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ejgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F655F15AD29802D8D06E92B5C3968A81F3733C5193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7030ae6b36e1ac6476bf6365de2db6a16f69f6bbcc6d34b5fea14eab7145895a
MD5 ddfe48b823123363d9a03c88bc4e9f67
SHA1 517eb36d698b5b501c6aefde911390bb3786808d
SHA512 c3978e12b68646d0cd16ef65c511e989ae54964d05272f87a7f83b56a5a874cf6a083897939bebd7dcc5511183bff604db8e825c32832123dac51f62c6d46d5f
SSDEEP 12288:0bkoU3f5hF8nXtqqOA6supeHDSnNyDARMYf3VCfLZMKqwzX:0b1UP5h+tMLcHDSNyDARM+3OLZTqwD
TLSH
T12E452951762AC74FC6AD40325E32D2CCA7707D01EE44AF0773C99B3F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 3b2850604cd05c1709055de493729cc93bb363f9f3b67ac46a224c9e20fba624
MD5 db107a1efb3dabfaf3fbf1b8cbf45e3b
SHA1 150f22ac5cefc66a42f50f58634d1b133b4d8048
SHA512 f862270ca53a6fe411ed0498fe12feae2f163abad0f2f72d5f079756cb8629fe9b695c88189577457831efa7248af8be041198a147b1e009f9dbc992e3d74128
SSDEEP 6144:HD8kAQNqHEap7AJCB/t2FV6XKrnfPRKTYbdAjM8CDSLfu2gDFXeYjpr2GCdw6MWC:RcV2/rXMNAxokvNss
TLSH
T17B65D841A537E38FC1BA6032073A5B4C7BB4EC16B7456E26B3C8153AD86A715B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 798fb1579b9e24c387d8c17032aed24cf3249c2da5d49dad75e46a86bb1be5cf
MD5 c55914c925d63f65625af54c24387509
SHA1 deb9783f9bf48bd11161294d76bb52d202e7e569
SHA512 42b49e579852b34b8a81230e326c1535518f0994fff7fe25029b62267ebfc77475109af5ca5fc977d4ad67266e5cf1578c7b9b59ddcddea39a94190cfd2166d9
SSDEEP 12288:H07S0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ELgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1974523629B580DC6F29FC3F090FBC760F5653EC0670089EBA6D0B69319B8CD99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1bbdf3e96821b49111d86b9bac1b792070b177ce25e7d85bd5a00d1b6d2a4e34
MD5 b682892306aef81f114ec10821d35df5
SHA1 9b5efd4769cb436b7dc66a6230d9c96819ce7e14
SHA512 12c53b6f2d6d5b323194b16595f756752fbf0f4c122337404678a241728500727405a5467862703482e7d03008641be61ebcbdcc8987e45b6ad2b8c748578460
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYtgXe4i7ojhsP5Lgrk1TWb4AN5:mgb4mBIBhGFBe30jaNf1TWbdz
TLSH
T1F465AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 fa4b68127e6193e923568ba71fedbceaaab7617c3523c07a2e76b1f5b63584ca
MD5 d07bfe190cb7bbd19ef6b5aad57c8391
SHA1 d506ec8712ceb257cf3470da0a4f0bccd5a6a04a
SHA512 941e3a3ddb709217af9299cef33c9a83858f4df5ee4ea86142b9a148356a78138ece877574ffbb1c73bf45b6ebb5c24b214b727034668234f810cb2ee2ca098b
SSDEEP 24576:pG88u8FpJqH1bzria7/m+gXe4i7ojhsP5Lgrk1TWb4AN5:87ZFPqVea7/Ae30jaNf1TWbdz
TLSH
T19E85F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b841ab3a9a261767d80414fb55089f4ce52b6850b39d7c330e8117f3098cd8b2
MD5 2285c5f9b3903f506a085637b17e7431
SHA1 f8b0f3f887ae7f17f0fa12a9d252cc7ec787863c
SHA512 50c62769b846b100606d591aba0ed708a0abb3c8a6a089404cb5b22e496a2288c17f763053a1e1d14c97e0fdd6c77010f03013df2c43bef263c868c0ed7ddf74
SSDEEP 24576:kPUr+NQSgXe4i7ojhsP5Lgrk1TWb4AN5:kJQFe30jaNf1TWbdz
TLSH
T1E965E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 96dce407f327043b1d83a8a0c86520337777a48a50c3a532c746c93911e50c10
MD5 5b56146df4c983e0bdb13e36e55d6356
SHA1 6ce70d9f6420fb0aac8e3e2b5acebfbe65138013
SHA512 3115d33714f3539fd0e0f86c07fd92b141827b6a99a0ac4aa418d9330500885da69694a3edf60efdbaacdf64c8a4fd6a53b8fb4748de66cdc7d2e5cd9766de14
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVe30jaNf1TWbdz:mG05lO43beU023W
TLSH
T1B9D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 082306b13647735a17c7280b807dd8848a83ea1ca3c18d038ffa62ec3731d22c
MD5 bdaeb7f8bc2aac8726bf7084d2430ffa
SHA1 5bec0224cbceb2ae39777b8d9d7c480c079b47d6
SHA512 69bb0db2233f4935289a2fb460148f5b75b663eaec89a3862806ec583b201df64af8ff66448bd2448882f89e0e99e8c30cd39ab0ab7eeaf02523019390929f2f
SSDEEP 24576:Nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnkgXe4i7ojhsP5Lgrk1TWb4AN5:9a5POZ3BJt2pasx2+mde30jaNf1TWbdz
TLSH
T1E565AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 38e50c16be59da9f044a9e58de80f6a6b4bb8d4d1977f316f5c4b916c30d23c4
MD5 9d65e118028c44457002226eef92ce98
SHA1 b65ba1f2f49d4af2a48c7d795bd18f930a9239f0
SHA512 28bad56d3191392f6131615b294ef383056cc8281a5d5b4d3551115507e7e59f1631e3b7b7f6bca638e8f8be7047d8d01472696335a4388e433e7ea7167cd0f2
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7FkWgXe4i7ojhsP5Lgrk1TWb4AN5:YNc/zEOVHFge30jaNf1TWbdz
TLSH
T1A7858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1c2947dc817ac59f9891126969d0dcb4d6d484881aa8165c0d29aa7d11abf9e5
MD5 09bb9980844db9a9c1458c0b28761b5b
SHA1 2577865934560034db66394d97d5db211ff939f3
SHA512 d14a829687b1466fcee4ab9ca54e2a2c98c60ec80fbfd0063432207f5c949018a3b0eff0f4b0176f68320ec183ecf534da81f2fa4f1ccdb98eda7bc2646ae138
SSDEEP 24576:wTkNvNnaFeYhJNtmZBmQgXe4i7ojhsP5Lgrk1TWb4AN5:wTMwBtOm3e30jaNf1TWbdz
TLSH
T1D055AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a8ad74845277580b61e8c63481078b0cf3bf7b384d00572ff73729d64472ef90
MD5 a30fd14f9bfae2bfd8cb54f0bd543e05
SHA1 a99250d8ba72cb12dba19e3c819b3a2e6e2c68c1
SHA512 2a0e4206c2f7341a1662a1c4f8764b8f52103cdcba18b4cdfbf37a83b5895d9993eac68d8d469befe0ae53af7c891f02e19dd0ce7bc05e9d100952683f81520e
SSDEEP 24576:/D3FHshBIYQgAngXe4i7ojhsP5Lgrk1TWb4AN5:/DVHeBIAAOe30jaNf1TWbdz
TLSH
T13D75E17DEA5C04E4E57BC1BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1012-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1012-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1012-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1012-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1076-127-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1076-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1076-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1076-129-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2512-50-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2512-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2512-39-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2512-46-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2512-45-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2512-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3524-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3524-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3524-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3524-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3524-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3604-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3604-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3604-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3604-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3612-320-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3612-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3612-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3612-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3612-289-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3612-81-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4432-109-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4432-108-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4432-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4432-115-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4500-269-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4500-73-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4500-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4500-67-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4720-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4720-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4720-231-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4720-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4852-1-0x00000000023A0000-0x0000000002407000-memory.dmp

Download

memory/4852-6-0x00000000023A0000-0x0000000002407000-memory.dmp

Download

memory/4852-0-0x0000000000400000-0x000000000052A000-memory.dmp

Download

memory/4852-77-0x0000000000400000-0x000000000052A000-memory.dmp

Download

memory/4852-7-0x00000000023A0000-0x0000000002407000-memory.dmp

Download

memory/5880-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5880-307-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5880-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5880-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5880-101-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5880-95-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6048-280-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6048-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download